DATA & SUBPROCESSORS

Sydney control plane. Disclosed overseas processing.

PatchFlow does not claim that all customer data remains in Australia. This page identifies each service boundary used by the private pilot.

Last reviewed 26 September 2026 · Private-pilot scope

Data flow

  1. 1
    GitHub identity and grantGitHub authenticates the user and identifies repositories selected for the App.
  2. 2
    PatchFlow control planeRepository metadata, policy, run state, check names, commits, and outcomes are stored in AWS Sydney.
  3. 3
    Coding agentManaged agent: the selected repository and bounded migration prompt are processed by Cursor under its separately granted GitHub access. Customer-hosted runner: the agent runs in the customer's own GitHub Actions under the customer's model account, which is the customer's processor, not PatchFlow's.
  4. 4
    Customer GitHub ChecksTests run in customer-controlled GitHub workflows; PatchFlow reads the resulting check state.

Current subprocessors

ProviderPurposeDataLocation boundary
Amazon Web ServicesHosting, database, workflow, secrets, logsIdentity, configuration, run metadata, webhook payloadsPrimary regional resources in Sydney; global CloudFront edge
GitHubOAuth, repository access, pull requests, ChecksGitHub identity, repository content and metadataGitHub global service
Cursor / AnysphereCoding-agent execution (managed agent only)Selected repository content, migration prompt, agent outputProvider-managed infrastructure; may process outside Australia
npm registryPublic package version and release metadataEligible public package name onlyPublic global service

What PatchFlow stores

  • GitHub numeric identity, login, App installation and selected repository identifiers
  • Migration policy, package versions, required Check names, repository commit SHAs
  • Run lifecycle, pull-request URL/state, bounded error and test-output excerpts
  • Agent execution identifiers, duration, usage, and settled cost
  • Invite, review, approval, launch, merge, and close timestamps

PatchFlow does not intentionally store customer CI secrets, provider API keys in the workspace, or full repository clones in the control-plane database.

Retention and deletion

Control-plane recordsPilot term; deletion completed within 30 days of verified request or agreed end
Webhook payloads90 days
CloudWatch logs30 days
Database backups7 days after source deletion
Invite grantsUp to 90 days or earlier revocation
Git repositoryRemains in GitHub; customer controls deletion

Request access, correction, export, or deletion at privacy@patchflow.run. We verify the requester against the relevant GitHub installation before destructive action.

Customer responsibilities

  • Install PatchFlow and the coding-agent integration only on approved repositories.
  • Do not place personal, health, payment-card, government-classified, or other regulated data in a pilot repository without written agreement.
  • Review GitHub and Cursor contractual and residency terms for the intended repository.
  • Maintain branch protection, least-privilege workflows, and named required Checks.